SQL injection (SQLi) is a web attack in which malicious input is inserted into a database query, letting the attacker read, change or delete data they should not have access to.
How SQL injection works
The flaw occurs when an application builds an SQL query by gluing user input directly into the query text. If a login form runs SELECT * FROM users WHERE name = 'input', an input such as ' OR '1'='1 changes the logic of the query. Variants include:
- in-band SQLi, where results appear directly on the page (error-based, UNION-based);
- blind SQLi, where the attacker infers data from true/false responses or time delays;
- out-of-band SQLi, where data is sent to an attacker-controlled server.
Depending on the database and its privileges, SQLi can go beyond data theft to writing files and remote code execution. Tools such as sqlmap automate discovery and exploitation.
Why SQL injection matters for security
SQLi is one of the oldest known web vulnerabilities and still part of the “Injection” category in the OWASP Top 10. It caused huge breaches: the 2008 Heartland Payment Systems attack exposed over 100 million card numbers, and in 2023 the Cl0p gang used an SQL injection in MOVEit Transfer (CVE-2023-34362) to steal data from thousands of organizations.
How to prevent SQL injection
- Use parameterized queries (prepared statements) or a safe ORM – never concatenate input into SQL.
- Give the application’s database account only the rights it needs.
- Validate input, hide detailed database errors from users and test code with SAST/DAST tools.
- A web application firewall helps as an extra layer, but not as a replacement for fixing the code.
